CAPEC-182 详情

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

执行流程

[Find Injection Entry Points] The attacker first takes an inventory of the entry points of the application.

• Spider the website for all available URLs that reference a Flash application.
• List all uninitialized global variables (such as _root.*, _global.*, _level0.*) in ActionScript, registered global variables in included files, load variables to external movies.

[Determine the application's susceptibility to Flash injection] Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to use various techniques such as direct load asfunction, controlled evil page/host, Flash HTML injection, and DOM injection to determine whether the application is susceptible to Flash injection.

• Test the page using direct load asfunction, getURL,javascript:gotRoot("")///d.jpg
• Test the page using controlled evil page/host, http://example.com/evil.swf
• Test the page using Flash HTML injection, "'>
• Test the page using DOM injection, (gotRoot(''))

[Inject malicious content into target] Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase

前提条件

The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

所需技能

The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.

所需资源

None: No specialized resources are required to execute this type of attack. The attacker may need to be able to serve the injected Flash content.

缓解措施

Implementation: remove sensitive information such as user name and password in the SWF file.
Implementation: use validation on both client and server side.
Implementation: remove debug information.
Implementation: use SSL when loading external data
Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.

相关弱点

参考资料

REF-46

Finding Vulnerabilities in Flash Applications
Stefano Di Paola.

REF-47

A Lazy Pen Tester's Guide to Testing Flash Applications
Rudra K. Sinha Roy.
http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/

REF-48

Creating More Secure SWF Web Application
Peleus Uhley.
http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html

提交记录

修改记录